import re
import sys
import os

'''
Python3
Date: 4 May 2020
Author: Carbon Black TAU - Jared Myers
Exemplar Hashes:
Description: Decodes PCI encoded data dumps from TinyPOS/PinkKite ShellCode Variants
'''
__VERSION__ = '1.0'


def decode(string):
   key = [0xfd,0xaa,0x0f,0x49,0xc2,0xbe,0xac,0x9f]
   out = ''
   counter = 0
   for byte in string:
       out = out + chr(byte ^ key[counter % 8])
       counter += 1
   return out.rstrip('\x00')


def data_chunks(data):
   data_split = re.split(rb'\x20{4}\xDD\x0A\xDD\x0A', data)
   return data_split


def main():

   try:
       global filename
       filename = sys.argv[1]

   except IndexError:
       print('POS exfil decoder v%s\n' % __VERSION__)
       print('Usage:\n %s <encoded file>' % (sys.argv[0]))
       quit()

   if not os.path.isfile(filename):
       print('[!]File Not Found Try Again')
       quit()
   try:
       data = open(filename, "rb").read()
       output = filename +"_decoded.txt"
       print('saving decoded data to:\t'+filename + "_decoded.txt")
       out = open(output,"w")
       for x in (data_chunks(data)):
           dec = decode(x)
           out.write(dec)
           print(dec)
       out.close()
   except Exception as e:
       print("[!!!] There seems to be a problem")
       print(e)


if __name__ == "__main__":
   main()
